Information Systems and IT 

Fundamentals 


Learning Objectives 


♦ To understand the need for Information Technology (IT) in business organizations and its 
relevance in Auditing; 

♦ To explain Business Process Automation (BPA) and understand the role of BPA in 
improving the business processes; 

♦ To understand the term ‘Computing’ and various popular computing architectures; 

♦ To understand Information System Layers - different layers of interaction in an 
Information System; 

♦ To explain Information System Life Cycle and the process of building Information 
Systems; and 

♦ To have an overview of recent technologies. 


Task Statements 


♦ To demonstrate the need for IT in business and its relevance in Auditing; 

♦ To demonstrate the benefit of BPA in Business Process Management; 

♦ To identify different disciplines of the computing field; 

♦ To identify different layers of Information Systems and their functions; 

♦ To review activities of different phases of Information System Life Cycle; 

♦ To identify different aspects of computing technologies; Cloud computing, Mobile 
computing etc., and their functioning; and 

♦ To identify some of the recent technologies/devices and their impact in organizations. 


Knowledge Statements 


♦ To know the need for IT and its advantages to business like communication capabilities, 
data and information management and automated processes; 


© The Institute of Chartered Accountants of India 








2.2 Information Technology 


♦ To know the importance and impact of IT in Auditing; 

♦ To know the Business Process Automation: Knowledge of deployment of BPA and how it 
complements Business Process Management; 

♦ To know the definition of Computing and its sub-disciplines; 

♦ To know Information System Layers: Knowledge of Information System layers, their 
functions, their types and the basic advantages and disadvantages of deploying them; 

♦ To know Information System Life Cycle: Knowledge of the phases involved in the 
development of Information Systems; 

♦ To know various computing technologies such as servers, end points and popular 
computing architectures; and 

♦ To know the Emerging Technologies: Knowledge of computing architectures & delivery 
models such as: SaaS, Cloud Computing, Mobile computing, etc. 

2.1 Introduction 

Information Systems (IS) are the foundation for conducting business today. For many 
enterprises, existence without extensive use of information systems is inconceivable (imagine 
Google without IS). IT plays a critical role in increasing operational excellence, customer and 
supplier intimacy, improved decision making and competitive advantage. When IT is integrated 
throughout the enterprise and linked with management, it can provide the foundation for new 
products, services and ways of conducting business result in strategic advantage. 

In the past, people could rely on manual processes to make decisions because they had 
limited amounts of information to process. Today, due to the new technologies of 
communication convergence, more and more relevant data is available with enterprises. 
While it is expected to help in arriving at more informed and appropriate decisions of various 
kinds, at the same time it is almost impossible for people to make decisions without the aid of 
information systems. Highly complex decisions must be made in increasingly shorter time 
frames. Adoption of IT is imperative today for running any business. 

The business enterprises initially used IT for various data processing functions. Now, we see a 
completely transformed working environment with IT playing a major role in almost all spheres 
of activities. Concepts of Business Process Automation (BPA) today form an integral part of 
any existing corporate environment with a substantial impact on business workflow to the 
bottom-most level. Any BPA is both a business process and an IT component. The IT 
component is crucial and is composed of computers as well as communication technologies 
which we need to understand. Businesses rely on information systems to carry out and 
manage their operations, interact with their customers and suppliers, and compete in the 
marketplace. 
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Developing any information system involves various defined phases commonly called as 
System Development Life Cycle. The whole of information flow in any information system 
involves layers of hardware, software (both Application as well as System), Database 
Management Systems and networks used to deliver the solution to the final consumer of 
services. These layers and the interaction amongst these layers have to be understood. 

We also need to understand various computing technologies and their components to truly 
appreciate the working of Information Systems. Understanding IT provides great insight to 
anyone learning about business and also how IT is creating efficiencies and effectiveness 
across the enterprise. Any individual anticipating a successful career in business, whether it is 
in accounting, finance, or operation management, must understand information technology 
and ultimately information systems. 

Let us understand how IT was used by as a game-changer in an Indian Company. For 
example, in early 90s, Mahindra & Mahindra realized that it had established different 
departments, which had their own information but had become islands of information. ERP 
implementation by the company helped in restructuring its business processes and integrating 
various business functions ultimately leading to better procurement cycles & reducing 
wastages. Company also launched its intranet, Mahindra Connect, to provide a platform for 
sharing company & employee related information. Thus, IT became the back-bone of 
enterprise operations providing the company providing strategic and competitive advantage. 

2.2 Need for Information Technology 

Understanding how IT is deployed in enterprises is imperative to learning about business. IT in 
the present context may be referred to as a computer-based tool that people use to work with 
information and support the information-processing needs of an enterprise. IT allows 
enterprises to work more efficiently and to maximize productivity. Faster communication, 
electronic storage and the protection of records are advantages that IT can give to any 
enterprise. From multi-national corporations which maintain mainframe systems and 
databases to small businesses that own a single computer; IT has a role to play everywhere. 

IT enables business enterprises to differentiate their products and services from that of their 
competitors. Those enterprises that leverage IT for competitive advantage often differ from 
their competitors in two ways: 

♦ They view IT as a strategic business enabler instead of viewing it as a cost component. 

♦ They work to maximize the efficiency of their IT operations so that they can focus their 
resources to providing value and responding to rapidly changing business conditions. 

If we look at the reasons for the all-pervasive use of IT for business, they would be: 

♦ Communication Capabilities; 

♦ Data and Information Management; and 

♦ Automated Processes. 
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2.2.1 Communication Capabilities 

IT provides resources to enterprises to communicate quickly and effectively. With these 
communication capabilities, enterprises can now integrate their business functions and 
segments spread across different geographical areas. Any global enterprise having an 
international presence can integrate its far flung business locations using communication 
capabilities offered by IT. 

Enterprises these days are equipped with email, video conferencing equipment and internal 
chat rooms which provide an efficient way to communicate and conduct business. Emails 
provide a simple and inexpensive way to communicate with clients or customers as well as 
vendors. Communication through email is faster and cost less than sending paper letters via 
postal mail. 

Over the years, a number of other communication tools have evolved, allowing staff to 
communicate using live chat systems, online meeting tools and video-conferencing systems. 
Voice Over Internet Protocol (VOIP) telephones and smart-phones offer even more high- 
tech ways for employees to communicate. Skype is one such popular VOIP service, which 
allows people across the world to make free, unlimited, superior quality voice calls via its 
innovative peer-to-peer software. 

Similarly WhatsApp Messenger is a cross-platform mobile messaging application which 
allows us to exchange messages without having to pay for SMS. It is available for: iPhone, 
BlackBerry, Android, Windows phone, Nokia and these phones can message each other. 
Because WhatsApp Messenger uses the same internet data plan that we use for e-mail and 
web browsing, there is no cost to message and stay in touch with friends. 

Recently many companies have started using a special kind of software, known as Team- 
ware, Collaboration Software or Groupware. This software allows collective and 
collaborative working of teams from different geographical locations on an online and real-time 
basis. 

2.2.2 Data and Information Management 

The days of large file rooms, rows of filing cabinets and the mailing of documents are fast 
fading away. Today, most enterprises store digital versions of documents on servers, storage 
devices and on cloud. These documents are instantly available to anyone with access rights, 
regardless of their geographical location. Thus enterprises are able to store and maintain a 
tremendous amount of historical data economically and employees benefit from immediate 
access to the documents they need. 

Further, IT also enables Information Security, which is a broad term encompassing the 
protection of information from accidental or intentional misuse by persons inside or outside an 
enterprise. IT security engineering systems protect enterprise electronic information from 
being hacked, or wiped out during a technological disaster. IT Security is perhaps the most 
fundamental and critical of all the technologies/disciplines an enterprise needs to implement 
appropriately by executing its business strategy so as to be able to not only survive but thrive 


© The Institute of Chartered Accountants of India 





Information Systems and IT Fundamentals 2.5 


in the digital age. Without appropriate security processes and procedures, none of the other 
technologies can give business advantages. Authentications and passwords limit access to 
confidential information. Using a program, information can be encrypted in a way to prevent 
unauthorized use, making it quite safe and secure. A lost, stolen or misplaced laptop or 
desktop computer can be tracked using security software that can be activated remotely. 

2.3 Importance of IT in Auditing 

IT is all pervasive and the impact is extensive for enterprises, professionals and individuals. IT 
encompasses all aspects of functioning of enterprises from strategy to operations, conception 
to completion and from ideation to value creation. Business, regulatory and competitive 
requirements are demanding innovation in technology deployment resulting in changing 
business models of delivery of services using diverse digital media. Successful enterprises in 
the digital age are those which create positive customer experience and make this their 
business lifeline. IT is crucial for delivering a positive customer experience and this in turn 
drives revenue and growth. Enterprises, professionals as individuals are becoming 
increasingly dependent on IT and need to knowingly or unknowingly embrace IT. Information 
Technology is evolving at an accelerating pace and the role of IT is transforming business 
processes. It is expected that role of IT in enterprises will fundamentally change from being a 
service provider to IT becoming a Service Broker, aggregator of services and primarily 
responsible for building, maintaining and sustaining the business relationship by rendering 
core services to the customer. 

Accountants and Auditors in their various roles ranging from accounting to auditing have to 
use and embrace technology to perform their jobs effectively and efficiently. They deal with 
data in myriad forms for analysis and decision-making. The location of digital data could be 
traced to computers and servers either at identified offices of clients or vendors. The 
increasing digitization of data leads to an increasing impact and exerts continuing pressure on 
Accountants and Auditors to expand their skills beyond traditional roles of using IT for office 
automation to providing innovative services harnessing the power of technology. The dynamic 
changes in IT create challenges in not only enterprises but also accountants and auditors in 
their professionals’ capacity. 

The traditional core competencies of auditors needs to be enhanced with increased 
understanding of technology systems and there is urgent need to develop the ability to 
process and integrate information among various areas of business practice. Auditors of the 
future will be called upon to provide solutions to complex issues by integrating specialized 
technology with their extensive experience to create new strategic business processes. 
Auditors will have to provide assurance on the security, effectiveness, and reliability of 
information, applications, and new and effective business practices and processes. As IT 
increasingly becomes a key enabler in enterprises of all types and sizes; and there is 
transformation from “Technology Oriented’’ to “Business and Technology Oriented’’. 
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2.3.1 Auditing in IT Environment 

Traditional methodology of audits had an audit trail which assisted the auditors in conducing 
and documenting the audit. However, the distinction in concepts between a manual 
environment and a computer based environment are highlighted below: 

Auditing in a computerized environment would depend on the scope and objective of audit. 
However, audit broadly would involve the process of evaluating and reporting the adequacy of 
system controls, efficiency, economy, effectiveness, and security practices to assure that 
assets and information resources are safeguarded, that data integrity is protected, and that 
the system complies with applicable policies, procedures, standards, rules, laws and 
regulations. The auditor has to look at both manuals and automated parts of the system 
because of their interfacing nature. 

The Audit Objectives 

The objectives of Audit would vary depending on the type, purpose objective and scope of 
audit. However, the general objectives of auditing in a computerized environment could 
include the following objectives of manual (external/internal) audit although the extent of 
coverage could vary based on scope and objectives: 

♦ Existence: Verify that the assets, liabilities, ownership, and/or activities are real; 

♦ Authorization: Verify that events have occurred in accordance with management's 
intent; 

♦ Valuation: Verify that the accounting values fairly present items worth; 

♦ Cutoff: Verify that the transaction is re-coded in the proper accounting period; 

♦ Compliance: Verify that the processing is in compliance with governmental laws and 
regulations, generally accepted accounting procedures, and the organization's policies 
and procedures; 

♦ Operational: Verify that the program, area, or activity is performed economically, 
efficient, and effectively; 

♦ Assisting management in finding ways to implementing internal control 
recommendations; 

♦ Participating in specifying and designing computer control and other features for systems 
to be installed; 

♦ Determining whether efficient use is made of the organization’s Computer resources; and 

♦ Determining whether Computer system used accomplishes the business objectives and 
goals. 

Differences in audit procedures are given as follows: 

♦ Study Technical Aspects: Gather evidential matter relating to technical aspects of 
systems under study, including all relevant documentation describing the computer 


© The Institute of Chartered Accountants of India 




Information Systems and IT Fundamentals 2.7 


facility, application programs, operating procedures, security procedures and so on. The 
focus is to begin from the peripheral controls (general controls) to application's controls. 

♦ Use Unique Techniques: Audit in a computerized environment would require application 
of unique techniques to these efforts. For example, the audit planning step includes 
review of technical documentation and interviewing technical specialists. The auditor 
must understand the procedures for testing and evaluating Computer Controls. 

♦ Audit Software Usage: These procedures include the use of generalized audit software 
to survey the contents of data files, the use of specialized software to assess the 
contents of operating system parameter files and flow-charting techniques for 
documenting the automated applications. 

2.3.2 IT Risks and Issues 

Regulations are making it mandatory for auditors to review the structure and systems of 
governance and risk management which is embedded in IT in most enterprises. A key 
requirement of enterprises in IT deployment is to ensure that business objectives are achieved 
and not mere implementation of latest technology. A key challenge in implementing IT is: 
“Higher the technology, Greater is the need for controls”. Hence, it becomes critical for 
enterprises to implement IT not only with right security but also to create business value. 
Auditors can play a critical role in reviewing security and facilitating enterprises to realize 
business value. The scope and objective of assurance do not change with technology but the 
way controls are reviewed is drastically changed. Auditors with their in-depth knowledge and 
core competencies in business process and internal control are uniquely positioned to provide 
assurance and consulting services in IT area. 

Enterprise risks include several components such as business risks, technology risks, 
operational risk and other risks. An overview of technology risks is discussed here. 
Technology risks are faced by enterprises that are heavily driven by and dependent on 
technology, especially where the types of technology used are rare and keep changing. When 
the technology used fails or becomes obsolete, the enterprise may not be able to continue 
with its business. Some of the issues that these enterprises have to deal with are following: 

♦ What type of process will the enterprise use to identify the business and technology risks 
when changes in technology occur (whether they arise from the use of new types of 
services, or from changes in equipment for existing services)? 

♦ What are the risks faced by the enterprise when it makes changes to a critical system (or 
systems) which cannot afford to fail? 

2.3.3 Need for Controls in Information Systems 

Technology has impacted what can be done in business in terms of information as a business 
enabler. It has increased the ability to capture, store, analyze and process tremendous 
amounts of data and information by empowering the business decision maker. With the advent 
of affordable hardware, technology has become a critical component of business. Today’s 
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dynamic global enterprises need information integrity, reliability and validity for timely flow of 
accurate information throughout the organization. Safeguarding assets to maintain data 
integrity to achieve system effectiveness and efficiency is a significant control process. 

A well designed information system should have controls built-in for all its sensitive or critical 
sections. For example, the general procedure to ensure that adequate safeguards over access 
to assets and facilities can be translated into an Information Systems related set of control 
procedures, covering access safeguards over computer programs, data and any related 
equipment. Information Systems control procedure may include the following: 

♦ Strategy and direction; 

♦ General Organization and Management; 

♦ Access to IT resources, including data and programs; 

♦ System development methodologies and change control; 

♦ Operation procedures; 

♦ System Programming and technical support functions; 

♦ Quality Assurance Procedures; 

♦ Physical Access Controls; 

♦ Business Continuity Planning(BCP) and Disaster Recovery Planning (DRP); 

♦ Network and Communication; 

♦ Database Administration; and 

♦ Protective and detective mechanisms against internal and external attacks. 

2.3.4 Special features of auditing in an IT environment 

Computer based Information Systems contains four interdependent elements: Hardware, 
Software, People and Procedures. All these four elements interact to process or convert 
data into information. Data is the accumulated but unorganized facts. Information is the 
usefully organized and reported facts which is usually generated (output) from the data (input) 
using the computer (hardware) as per the procedures (Software) laid down by the 
management (people). The awareness required by an Auditor for auditing in a IT environment 
are to: 

♦ know the Methodology of Audit so to ensure that the standards, proper usage of common 
procedures and techniques in the performance of audits is adhered to. 

♦ understand the steps and techniques necessary to plan, perform and complete the Audit. 

2.3.5 Impact of IT on Risks and Controls 

Data handling capacity of computer combined with telecommunications technology greatly 
increases ability of an individual to access and perhaps to manipulate large quantities of data - 
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within a relatively short time period: thus, increasing amount of potential damage or risk of 
exposure. 

♦ Ready access to terminals as computerized Information Systems are highly distributed 
and leads to ease in perpetration of computer related crimes thereby increasing 
temptation for abuse. 

♦ On-line processing of data and validation checks would help the prospective perpetrator 
in guessing passwords and aid in circumventing controls in inputs to computer. 

♦ Appropriate controls are not resident within the computer systems to detect or to prevent 
the accidents. If threats are not anticipated and adequate controls are not designed to 
mitigate or counter them, system and its resources will be vulnerable. 

♦ The greatest exposure of all is a failure to recognize risks or potential impacts of those risks. 
Prudence demands that contingencies are to be anticipated and planning done to handle 
them. 

The four major areas in which controls have been affected are: 

♦ Realignment of functions data entry and source of transactions may be centralized; 

♦ Changes in custody of files and documents. Ready access to data over telecom links 
complicate custodial functions of data. Data librarian may become in charge for data; 

♦ Transfer of responsibilities Single action by user may complete the entire processing cycle of 
the transaction; and 

♦ Decline of accountability Traditional functions, responsibilities and boundaries have been 
eliminated or are obscured by new methods. 

2.3.6 Auditors’ Concern 

The increased risks and changes in traditional control functions lead to a shift in the auditors 
concern. The key concerns of auditor are as follows: 

♦ Develop and apply new criteria in evaluating control weaknesses in Computerized 
Information Systems (CIS); 

♦ Tailor testing techniques to the CIS under study; and 

♦ Use computers to perform some portions of audit examination. 

For more detailed discussion on relevance of IT in Auditing, students may refer the Study 
Material of ‘Auditing and Assurance’ Paper of Intermediate (IPC) Course. 

2.4 Overview of Business Process Automation 

If we take a close look at some of the workflow process or daily activities that employees 
usually perform to run the business operations, we will find that several of these tasks 
performed are repetitive, as well as, tedious. Repeated manual data manipulation is rarely an 
efficient use of resources and most easily demonstrates the value of the BPA concept. Basic 
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tasks that currently use human intervention, such as purchase order processing can often be 
delayed until the specific employee tasked with handling that process is available, these kinds 
of tasks could easily be automated. 

The role of management for any business is to maximize their shareholders' ROI (Return On 
Investment). In order to achieve this goal, firms must identify any unnecessary amount of work 
and eliminate inefficient labor. Business workflow is a task-based process. From simple data 
entry to the more complex manipulation of that data, we can almost always define the 
business workflow process as a series of discrete tasks. Various combinations of these 
discrete tasks make up the business processes. These tasks can be broken down into their 
component actions, which mean that they can be automated. Efficiently and effectively 
automating these types of tasks is what BPA is all about. 

At its simplest, Business Process Automation (BPA) may be defined as the automation of 
business processes. In other words, it may be defined as removing the human element from 
existing business processes by automating the repetitive or standardized process 
components. On its own, BPA automates processes that are part of business function. 

To achieve this automation, we would need IT infrastructure, hardware and software to 
manage the same. Further, all the systems have to be networked so that information can flow 
seamlessly. In addition, the need would be for database so that the data and information can 
be stored and retrieved in a desired and appropriate manner. If we now look at IT perspective 
then we can also visualize the following IT processes, which are usually involved in a typical 
business enterprise: 

♦ Database access and changes: It provides access to data via ODBC (Open DataBase 
Connectivity) connections, data updates, and file transfers. 

♦ File replication and data backup: It protects valuable data by backing up databases 
and key systems. 

♦ Systems and event log monitoring: It reviews and analyzes the event log and critical 
systems, and create multistep corrective action, such as restarting a server service. With 
BPA, these processes run automatically when certain events occur. 

♦ Job scheduling: It automates processes that perform a variety of daily or unscheduled 
tasks. 

♦ Application integration: It automates IT and business processes by combining 
applications that drive business. Complex processes such as database queries, data 
transformation and spreadsheet integration can be automated. 

♦ File transfers: It can be automated to deliver and retrieve data on set schedules. 

♦ Printing: It is automated to simplify print jobs. 

BPM and BPA are complementary technologies and concepts, but we can use BPA to make 
existing processes more efficient, not only at enterprise level but even for desktop users’ 
through simple workflows, access and authorizations. Deploying a BPA solution can be the 
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first step in a corporate BPM deployment. BPM aims to improve process agility, operational 
excellence and cost efficiency by capturing the total picture of all workflows involved in a 
business process. 

BPA solutions feature three critical pillars - Orchestration, Integration, and Automation. 
Tight coupling of these elements enables organizations to streamline and automate business 
processes regardless of scope, scale, and complexity. BPA application ties up the following 
activities: 

♦ Integration: BPA allows applications and operating systems not only to read data that 
the systems produce, but also to pass data between the component applications of the 
business process and to modify the data as necessary. 

♦ Orchestration: The process of orchestration enables the ability to bring tasks that exist 
across multiple computers and different business departments or branches under one 
umbrella that is the business process itself. 

♦ Automation: Orchestration and integration unite with automation to deliver the capability 
to provide a rules-based process of automatic execution that can span multiple systems 
and enable a more effective, nimble and efficient business process. 

BPA can make the business processes faster and more efficient, robust, and flexible. The 
approach to business process automation entails understanding how information is collected 
and processed on a day-to-day basis and then making recommendations on how best to 
automate those processes for maximum benefit. The steps involved in any BPA are as follows: 

♦ Step 1 : Define why we plan to implement BPA? 

♦ Step 2: Understand the rules/ regulation under which it needs to comply with? 

♦ Step 3: Document the process, we wish to automate. 

♦ Step 4: Define the objectives/goals to be achieved by implementing BPA. 

♦ Step 5: Engage the business process consultant. 

♦ Step 6: Calculate the ROI for project. 

♦ Step 7: Development of BPA. 

♦ Step 8: Testing the BPA. 

Business Process Automation can be largely aided by Enterprise Resource Planning (ERP) 
that enables companies to replace traditional business silos with tightly integrated structures 
that encompass internal processes, human resources, and technology and enterprise strategy. 
Activities that are typically covered by ERP include accounting, sales/marketing/client 
management, purchase management, production management, costing, inventory control and 
human resources management. 
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For further details of these aforementioned steps, students may refer Chapter-5 “Business 
Process Automation through Application Software” of the Study Material of Intermediate (IPC) 
Course. 

2.5 Overview of Computing 

The term ‘Computing’ has a great significance in IT related aspects. These are various 
definitions given by the experts/organisations worldwide, out of these; one of the most popular 
definitions is given by ACM, which defines “Computing as any goal-oriented activity requiring, 
benefiting from or creating computers. Thus, computing includes designing and building 
hardware and software systems for a wide range of purposes; processing, structuring, and 
managing various kinds of information; doing scientific studies using computers; making 
computer systems behave intelligently; creating and using communications and entertainment 
media; finding and gathering information relevant to any particular purpose, and so on. The list 
is virtually endless, and the possibilities are vast.’’ 

It defines five sub-disciplines of the computing field, which are briefly explained here: 

♦ Computer Science, 

♦ Computer Engineering, 

♦ Information Systems, 

♦ Information Technology, and 

♦ Software Engineering. 

Computer Science: It refers to the scientific and practical approach to computation and its 
applications. It is the systematic study of the feasibility, structure, expression, and 
mechanization of the methodical processes (or algorithms) that underlie the acquisition, 
representation, processing, storage, communication of, and access to information, whether 
such information is encoded in bits and bytes in a computer memory or transcribed in genes 
and protein structures in a human cell. 

Computer Engineering: It refers to the discipline that integrates several fields of electrical 
engineering and computer science required to develop computer hardware and software. 
Computer engineers are involved in many hardware and software aspects of computing, from 
the design of individual microprocessors, personal computers, and supercomputers, to circuit 
design. This focuses not only on how computer systems work but also how they integrate and 
work a holistic system. 

Information System (IS): It refers to the study of complementary networks of hardware and 
software that enterprises, employees or individuals use to collect, process, create, store and 
distribute data. Any specific Information System aims to support operations, management and 
decision making. Information System also refers to not only Information and Communication 
Technology (ICT) that an enterprise uses but also to the way in which staff, customers and 
vendors interacts with ICT to facilitate business processes in an integrated manner. 
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Information Technology (IT): It refers to the application of computers and 

telecommunications to store, retrieve, transmit and manipulate data in for processing of 
information in enterprises. Generally, IT encompasses not only computers and computer 
networks but also other information distribution technologies such as television and 
telephones. IT industry in general is supported by multiple industry sectors such as computer 
hardware, software, electronics, semi-conductors, internet, telecom equipment, e-Commerce 
and computer services. In a business context, the Information Technology Association of 
America has defined Information Technology as "the study, design, development, application, 
implementation, support or management of Computer-Based Information Systems". The 
responsibilities of those working in the field include network administration, software 
development and installation, and the planning and management of an organization's 
technology life cycle, by which hardware and software is maintained, upgraded and replaced. 

Software Engineering: It refers to the application of a systematic, disciplined, quantifiable 
approach to the design, development, operation, and maintenance of software, and the study 
of these approaches, which is primarily the application of engineering to software. 

Enterprises use IT to provide information systems, which process and provide information to 
users. As accountants and auditors, we are primarily concerned and need to be well versed 
with the disciplines of Information Systems and Information Technology in their practical 
deployment. 

2.6 Computing Technologies 

Brief overview of some of the key computing technologies is given as follows: 

2.6.1 Server 

From a hardware perspective, a server is a computer (Hardware) or device on a network 
dedicated to run one or more services (as a host), to serve the needs of the users of other 
computers on a network. However in the context of client-server architecture, a server is a 
computer program running to serve the requests of other programs, the "clients". Thus, the 
server performs some computational task on behalf of "clients." The clients either run on the 
same computer, or they connect through the network. 

Servers are often dedicated, meaning that they perform no other tasks besides their server 
tasks. On multiprocessing operating systems, however, a single computer can execute several 
programs at once. A server in this case could refer to the program that is managing resources 
rather than the entire computer. Essentially it is not the size of a computer system that makes 
it a server. It is in-fact based on the function that it provides. Any computer system that 
provides some sort of service can be referred to as a server. 

There are different types of servers, based on the nature of service they provide. Some of 
them are given as follows: 

♦ File server: This is a computer and storage device dedicated to storing files. Any user on 
the network can store files on the server. 
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♦ Print server: This is a computer that manages one or more printers. 

♦ Network server: This is a computer that manages network traffic. 

♦ Database server: This is a computer system that processes database queries. 

♦ Application Server: This is a program that handles all application operations between 
users and an enterprise's backend business applications or databases. 

♦ Web Servers: Web servers are computers that deliver (serves up) web pages. Every 
web server has an IP address and possibly a domain name. For example, if we enter the 
URL http://www.icai.org in our browser, this sends a request to the Web server whose 
domain name is icai.org. The server then fetches the home page named and sends it to 
our browser. Any computer can be turned into a Web server by installing server software 
and connecting the machine to the Internet. 

♦ Mail Server: Mail servers move and store mail over corporate networks. 

Let us look at the case study of an Indian Company relating to usages of servers: 

The Indian Rayon unit of the Aditya Birla Nuvo group is the second largest producer of 
Viscose Filament Yarn (VFY) in India, in terms of its market share. But, with the financial 
crisis, there was pressure on the IT team to contain costs. The best way to do that was to 
consolidate its servers. They conducted a study on the different servers being used and their 
deployment and based on study consolidated the servers as required there by eliminating 
redundancy and reducing cost. 

2.6.2 Popular Computing Architecture 

The computer is based on a fixed hardware platform, capable of executing a fixed repertoire of 
instructions. At the same time, these instructions can be used and combined like building 
blocks, yielding arbitrarily sophisticated programs. Importantly, the logic of these programs is 
not embedded in the hardware platform. Instead, the program’s code is stored and 
manipulated in the computer memory, just like data, becoming what is known as “software”. 
Since the computer’s operation manifests itself to the user through the currently executing 
software, the same hardware platform can be made to behave completely differently each time 
it is loaded with a different program. 

In Computer Engineering, Computer Architecture can be defined as the science and art of 
selecting and interconnecting hardware components to create computers that meet functional, 
performance and cost goals. It is the technical drawings and functional description of all 
design requirements (especially speeds and interconnections); it is how to design and 
implement various parts of a computer focusing largely on the way by which the Central 
Processing Unit (CPU) operates internally and how it accesses addresses in memory. 

Computer architecture includes at least three main subcategories: 

(i) Instruction Set Architecture (ISA) 

Instruction set is the set of machine code instructions that the processor can carry out. 
CPU (Processor), the centre piece of the computer’s architecture, is in charge of 
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executing the instructions of the currently loaded program. Each processor has its own 
unique instruction set specifically designed to make best use of the capabilities of that 
processor. These instruction set tells the processor to carry out various calculations, to 
read and write values from and into the memory, and to conditionally jump to execute 
other instructions in the program. 

Instruction Set Architecture is the abstract model of a computing system that is seen 
by a machine language programmer including the instruction set; memory address 
modes; processor registers; and address and data formats. Basically Instruction Set 
Architecture (ISA) is related to the programming of a computer - that is, how the 
computer understands what each element in its basic language means, what instructions 
are to be carried out and in what order, etc. The ISA basically deals with what the chip 
does. It’s a sort of ‘bridge’ between software and hardware. Understanding how it all 
works requires knowledge of the structure of a computer and its assembly language. The 
instructions may be Data Movement Instructions, Transfer of Control, Arithmetic/Logical 
Instructions; Input/output and some miscellaneous instructions that handle interrupts and 
activities. 

Fixed and Variable length Instructions 

Instructions are translated to machine code. In some architecture, all machine code 
instructions are the same length i.e. fixed length. In other architectures, different 
instructions may be translated into variable lengths in machine code. 

Variable length instructions are commonly used on CISC machines. The advantage of 
using variable length instructions is that each instruction can use exactly the amount of 
space it requires, so that variable length instructions reduce the amount of memory 
space required for a program. 

On the other hand, it is possible to have fixed length instructions, where as the name 
suggests, each instruction has the same length. Fixed length instructions are commonly 
used with RISC processors. Since each instruction occupies the same amount of space, 
every instruction must be long enough to specify a memory operand, even if the 
instruction does not use one. Hence, memory space is wasted by this form of instruction. 
The advantage of fixed length instructions is that they make the job of fetching and 
decoding instructions easier and more efficient, which means that they can be executed 
in less time than the corresponding variable length instructions. 

In general, computer programs that execute very quickly tend to use larger amounts of 
storage, while programs to carry out the same tasks, that do not use so much storage, 
tend to take longer to execute. 

Classification of Instruction Sets 

An important aspect of computer architecture is the design of the instruction set for the 
processor. The instruction set chosen for a particular computer determines the way that 
machine language programs are constructed. These are of basically two types, which are 
given as follows: 
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• Complex Instruction Set Computer (CISC): If the control unit contains a number 
of micro-electronic circuitry to generate a set of control signals and each micro- 
circuitry is activated by a micro-code, this design approach is called CISC design. 
Examples of CISC processors are: Intel 386, 486, Pentium, Pentium Pro, Pentium 
II, Pentium III processors etc. CISC chips have a large, variable length and complex 
instructions and generally make use of complex addressing modes. Different 
machine programs can be executed on CISC machine. Since CISC processors 
possess so many processing features, the job of machine language programmers 
becomes easier. But at the same time, they are complex as well as expensive to 
produce. Now-a-days, most of the personal computers use CISC processors. 

• Reduced Instruction Set Computer (RISC): To execute each instruction, if there is 
separate electronic circuitry in the control unit, which produces all the necessary signals, 
this approach of the design of the control section of the processor is called RISC design. 
It is also called hard-wired approach. Examples of RISC processors: IBM RS6000, 
MC88100 processors etc. RISC processors use a small and limited number of 
instructions and mostly use hardwired control unit. These consume less power and are 
having high performance. RISC processors use simple addressing modes and RISC 
instruction is of uniform fixed length. Since RISC processors have a small instruction 
set, they place extra demand on programmers. However, RISC processors are faster, 
less complex and less expensive than CISC processors because of their simpler design. 
Since RISC design uses more lines of code hence, more RAM is needed to store the 
assembly level instructions. Also, the compiler must also perform more work to convert 
a high-level language statement into code of this form. 

RISC vs CISC - An Example of multiplication of two numbers in memory. 

Suppose that the main memory is divided into locations numbered from (row) 1: (column) 
1 to (row) 5: (column) 4. The execution unit is responsible for carrying out all 
computations. However, the execution unit can only operate on data that has been 
loaded into one of the four registers (A, B, C, or D). Let's say we want to find the product 
of two numbers - one stored in location 1:3 and another stored in location 4:2 and store 
back the result to 1:3. 

CISC Approach 

CISC design would try to finish the task in the 
minimum possible instructions by implementing 
hardware which could understand and execute 
series of operations. Thus the processor would 
come with a specific instruction ‘MUL’ in its 
instruction set. ‘MUL’ will load the two values from 
the memory into separate registers, multiplies the 
operands in the execution unit, and then stores the 
product in the appropriate location. So, the entire 



Exexution Unit 


© The Institute of Chartered Accountants of India 


Information Systems and IT Fundamentals 2.17 


task of multiplying two numbers can be completed with one instruction: 

MUL 1:3, 4:2 

MUL is referred to as a "complex instruction" as it operates directly on the computer's 
memory banks and does not require the programmer to explicitly call any loading 
or storing functions. 

RISC Approach 

RISC processors use simple instructions that can be executed within a clock cycle. Thus, 
‘MUL’ instruction will be divided into three instructions. 

(i) "LOAD," which moves data from the memory bank to a register, 

(ii) "PROD," which finds the product of two operands located within the registers, and 

(iii) "STORE," which moves data from a register to the memory banks. 

In order to perform the task, a programmer would need to code four lines of assembly: 
LOAD A, 1 :3 
LOAD B, 4:2 
PROD A, B 
STORE 1:3, A 

(ii) Micro Architecture 

Micro Architecture, also known as Computer Organization, is a lower level detailed 
description of the system that is sufficient for completely describing the operation of all 
parts of the computing system, and how they are inter-connected and inter-operate in 
order to implement the ISA. This describes the data paths, data processing elements and 
data storage elements, and describes how they should implement ISA. The Micro 
architecture can be seen as how the ISA does and what it does. It’s how everything is 
ultimately organized on the chip or processor. 

Micro architecture is the term used to describe the resources and methods used to 
achieve architecture specification. The term typically includes the way in which these 
resources are organized as well as the design techniques used in the processor to reach 
the target cost and performance goals. The micro architecture essentially forms a 
specification for the logical implementation. 

(iii) System Design 

It includes all of the other hardware components within a computing system such as: 

• System interconnects-Computer buses and switches: Computer Bus is a 

communication system that transfers data between components inside a computer, 
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or between computers that covers all related hardware components (wire, optical 
fiber, etc.) and software, including communication protocol. 

• Memory controllers and hierarchies: The Memory Controller is a digital circuit 
which manages the flow of data going to and from the main memory and can be a 
separate chip or integrated into another chip. 

• CPU off-loads mechanisms - Direct Memory Access (DMA): Direct Memory 
Access (DMA) is a feature of modern computers that allows certain hardware 
subsystems within the computer to access system memory independently of 
the central processing unit (CPU). 

• Issues-multi-processing, virtualization, software features etc. 

> Multiprocessing is the use of two or more Central Processing Units (CPUs) 
within a single computer system to allocate tasks between them. 

> Hardware Virtualization or Platform Virtualization refers to the creation of 
a virtual machine that acts like a real computer with an operating system. 
Software executed on these virtual machines is separated from the underlying 
hardware resources. 

To understand these computer concepts, let’s try to understand in terms of building a car, 
Honda City: 

♦ Let’s say Honda Japan has set up a manufacturing Unit in Greater Noida, India which is 
manufacturing Honda City Cars. To manufacture these cars Honda needs an assembly 
line (CPU) where workers would be assembling roughly 30,000 parts to make 1 car. 

♦ It would not be possible to stock all 30,000 parts in shelf next to assembly line, because 
stocking all parts in shelves next to assembly line and finding any part out of these 
30,000 parts would make the process very slow. So, around 16 parts immediately 
needed could be stocked in shelf (Register) next to assembly line. 

♦ But after assembling the dash board, we want to assemble Steering wheel assembly for 
which a different set of components would be needed. These parts, which perhaps we 
would need for the rest of the day would be stocked in Assembly store (Cache) adjoining 
the assembly line, where some 512 parts can be stored so that they could be procured 
quickly. 

♦ For the many parts which would be required over the next week, we have a Warehouse 
(RAM) some 8 km from the city; since land prices are cheap there and we deploy delivery 
vans (Bus) for transporting the parts to assembly line. This Warehouse is big and can 
hold some 30,000 different parts required for manufacturing Honda City. 
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♦ In the assembly line we are manufacturing Honda City but we are also planning to 
produce Honda Brio and also planning some model changes in City. So Honda has a 
worldwide warehouse (Hard Disk) in Tokyo where it stocks all the possible parts required 
by different models and versions and could be sent to any warehouse on request. 

♦ Now, to assemble, a worker would have to follow various steps, referred as Machine 
Cycle (Fetch-Decode-Execute-Store) which gets executed within CPU and are given in 
Table 2.6.1: 

Fetch + Decode I + 1 Execute I + 1 Store 


Table 2.6.1 : Steps for a worker to assemble 

A Worker prints an instruction sheet (IF) fetch an instruction from the currently 
and gives to in-charge. running program, pass it to the next stage. 

The in-charge gets a sheet. He (ID) instruction would be decoded to 
reads and understands, picks two figure out what we actually need to do and 
parts to be joined before the grab the two registers we’re going to do 
assembler (whose job is to math with, 
assemble parts). 

The assembler would then take the (EX) execution unit will then perform 
two parts and join it. some operation like an addition, 

multiplication or comparison on these two 
registers’ contents. 

If the joined pieces are not (MEM) memory access stage will handle 
immediately needed a worker would storing or loading values between the 
transport them to assembly store or registers and the RAM. 
warehouse. 

After completing the job, a worker (WB) Write Back the result to another 
will put the final result on the register so it’s ready to go for the next 
assembly shelf. operation. 

♦ These phases, fetch and decode are done by Control Unit (CU) whose job is to 
understand and explain to Arithmetic Logic Unit (ALU) whose job is to execute and 
results are stored in Register. This is machine cycle - the basis of computing. 

♦ The Honda company car designers from headquarters in Japan issues instructions for 
manufacturing Honda City to the assembly Line workers in Greater Noida, but these 
designers have to know what instructions these workers are capable of following. These 
Instructions, which these workers are capable of following, are called Instruction Sets. 
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All instructions for manufacturing car have to ultimately be broken down to instructions 
the workers can understand. These instructions are given in Table 2.6.2. 

♦ With the specific instruction, we can virtually do everything in a computer. Whatever we 
want a computer to do has to be broken down into above instruction which has to be 
explained in machine language to these hardworking workers (hardware). 

♦ The above amply explains the computing process of our computer. Honda would be 
having some SOP (Standard Operating Procedures) manuals and all other manuals 
relating to workflow and design of assembly area. This could be considered to be Micro- 
architecture. 


Table 2.6.2: Instructions for Workers 


Instruction 

Meaning in Honda City Plant 

In Computer’s CPU 

Load 

If a part isn’t currently on the shelf, 
get it from Assembly Store. 

Load some data from the RAM 
into a register. 

Store 

If the shelf is full, we need to make 
space, so we should pick a piece 
that won’t be needed immediately 
and store it in the Assembly store. 

Free up a register by storing its 
data back into RAM. 

Add 

Attaching a part to another and then 
bringing it back to the shelf. 

Add two pieces of data together. 
This could also be other 
common math operations like 
subtract, multiply, divide, shift, 
etc. 

Compare 

We need to check if a piece is going 
to fit before installing it, otherwise 
follow alternate instructions. 

Check to see if one piece of data 
is bigger or smaller than 
another. 

Branch 

When we need to follow alternate 
instructions, either due to an 
incorrect piece as above, or 
because we need to repeat a certain 
step several times, we simply jump 
to the new location in the 
instructions and resume work from 
there. 

Jump to a new location in the 
code and continue executing 
from there. 


2.6.3 Emerging Computing Models 

This section provides brief overview of emerging computing technologies whose impact on 
enterprises will be felt increasingly in the near future. These emerging technologies are given 
as under: 
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(I) Cloud Computing: Cloud Computing is the use of various services, such as software 
development platforms, servers, storage, and software, over the Internet, often referred 
to as the "cloud." 

A. Cloud Computing Environment 

The cloud computing environment can consist of multiple types of clouds based on 
their deployment and usage. These are depicted in the Fig. 2.6.1 and are explained 
as follows: 


• used for a single 
organization; can be internally 
or externally hosted 


PRIVATE 


• shared by several 
organizations; 
typically extrenally 
hosted, but may be 
internally hosted by 
one of the 
organizations 

COMMUNITY 


•composition of two or 
more clouds (private, 
community or public) 
that remain unique 
entities but are bound 
together, offering the 
benefits of multiple 
deployment models, is 
internally & externally 
hosted 




provisioned for 
open use for the 
public by a 
particular 
organization who 
also hosts the 
service 


Fig. 2.6.1: Cloud types and their relation 

• Public Clouds: The public cloud is made available to the general public or a large 
industry group. They are administrated by third parties or vendors over the Internet, 
and services are offered on pay-per-use basis. The key benefits are as follows: 

(a) It is widely used in the development, deployment and management of 
enterprise applications, at affordable costs; 

(b) It allows organizations to deliver highly scalable and reliable applications 
rapidly and at more affordable costs. 

• Private Clouds: This cloud computing environment resides within the boundaries of 
an organization and is used exclusively for the organization’s benefits. These are 
also called internal clouds. They are built primarily by IT departments within 
enterprises who seek to optimize utilization of infrastructure resources within the 
enterprise by provisioning the infrastructure with applications using the concepts of 
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grid and virtualization. The benefit of a Private Cloud is that it enables an enterprise 
to manage the infrastructure and have more control, but this comes at the cost of IT 
department creating a secure and scalable cloud. 

• Community Clouds: This is the sharing of computing infrastructure in between 
organizations of the same community. For example, all Government organizations 
within India may share computing infrastructure on the cloud to manage data. The 
risk is that data may be stored with the data of competitors. 

• Hybrid Clouds: It is maintained by both internal and external providers. It is a 
composition of two or more clouds (Private, Community or Public). They have to 
maintain their unique identity, but are bound together by standardized data and 
application portability. With a hybrid cloud, organizations might run non-core 
applications in a public cloud, while maintaining core applications and sensitive data 
in-house in a private cloud. 

B. Cloud Computing Architectural Considerations 

Cloud Computing Architecture refers to the components and subcomponents that 
typically consist of a front end platform (fat client, thin client, mobile device), back 
end platforms (servers, storage), a cloud based delivery, and a network (Internet, 
Intranet, Intercloud). Combined, these components make up cloud computing 
architecture. Cloud architecture typically involves multiple cloud components 
communicating with each other over a tight or loose coupling of cloud resources, 
services, middleware, and software components. 

The protection in cloud computing depends on having the right architecture for the 
right application. Organizations must understand the individual requirements of their 
applications, and if already using a cloud platform, understand the corresponding 
cloud architecture. 

A cloud computing architecture consists of two parts - Front End and a Back End 
that connect to each other through a network, usually the Internet. The front end is 
the side the computer user, or client, sees. The back end is the “cloud” section of 
the system. 

• Front End: The Front End of the cloud computing system comprises of the 
client’s devices (or it may be a computer network) and some applications are 
needed for accessing the cloud computing system. All the cloud computing 
systems do not give the same interface to users. For example-Web services 
like electronic mail programs use some existing web browsers such as Firefox, 
Microsoft’s internet explorer or Apple’s Safari. Other types of systems have 
some unique applications which provide network access to its clients. 

• Back End: Back End refers to some physical peripherals. In cloud computing, 
the back end is cloud itself which may encompass various computer machines, 
data storage systems and servers. Groups of these clouds make a whole cloud 
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computing system. Theoretically, a cloud computing system can include 
practically any type of web application program such as video games to 
applications for data processing, software development and entertainment 
residing on its individual dedicated server for services. There are some set of 
rules, generally called as Protocols which are followed by this server and it 
uses a special type of software known termed as Middleware that allow 
computers that are connected on networks to communicate with each other. If 
any cloud computing service provider has many customers, then there’s likely 
to be very high demand for huge storage space. Many companies that are 
service providers need hundreds of storage devices. 

C. Service Models of Cloud Computing 

The service models are dynamically changing as cloud providers come out with new 
offerings focused on being competitive, increase market share, each with the aim to 
becoming one-stop shop. Mainly, there are five Cloud Computing Service based 
models. These are given as follows: 

• Infrastructure as a Service (laaS): It is the foundation of cloud services. It 
provides clients with access to server hardware, storage, bandwidth and other 
fundamental computing resources. The service is typically paid for on a usage 
basis. The service may also include dynamic scaling so that if the customer 
needs more resources than expected, s/he can get them on the fly (probably to 
a given limit). It provides access to shared resources on need basis, without 
revealing details like location and hardware to clients. 

• Software as a Service (SaaS): It includes a complete software offering on the 
cloud. Users can access a software application hosted by the cloud vendor on 
pay-per-use basis. This is a well-established sector. SaaS is a model of 
software deployment where an application is hosted as a service provided to 
customers across the Internet by removing the need to install and run an 
application on a user’s own computer. It is seen as a way for businesses to get 
the same benefits as commercial software with smaller cost outlay. SaaS can 
alleviate the burden of software maintenance and support but users relinquish 
control over software versions and requirements. 

• Platform as a Service (PaaS): It provides clients with access to the basic 
operating software and optional services to develop and use software 
applications (e.g. database access and payment service) without the need to 
buy and manage the underlying computing infrastructure. For example, Google 
App Engine allows clients to run their web applications (i.e. software that can 
be accessed using a web browser such as Internet Explorer over the internet) 
on Google’s infrastructure. It has evolved from Software as a Service (SaaS) 
and Infrastructure as a service (laaS).The major drawback of Platform as a 
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Service is that it may lock us into the use of a particular development 
environment and stack of software components. 

• Network as a Service (NaaS): It is a category of cloud services where the 
capability provided to the cloud service user is to use network/transport 
connecting services. NaaS involves optimization of resource allocation by 
considering network and computing resources as a whole. Some of the 
examples are: Virtual Private Network, Mobile Network Virtualization etc. 

• Communication as a Service (CaaS): CaaS has evolved in the same lines as 
SaaS. CaaS is an outsourced enterprise communication solution that can be 
leased from a single vender. The CaaS vendor is responsible for all hardware 
and software management and offers guaranteed Quality of Service (QoS). It 
allows businesses to selectively deploy communication devices and modes on 
a pay-as-you-go, as-needed basis. This approach eliminates the large capital 
investments. Examples are: Voice over IP (VoIP), Instant Messaging (IM), 
Collaboration and Videoconferencing application using fixed and mobile 
devices. 

Enterprises have to select the right service model based on their specific 
requirements. The selection has to be done considering various factors such as cost 
benefit analysis, relevant risks, security and controls and the criticality of the data 
and services. Typically, the enterprises would choose the model, which offers them 
the best savings with the required security. 

For further details, students are advised to refer to Chapter 5 “Business Process 
Automation through Application Software” of the Study Material of Intermediate (IPC) 
Course. 

(II) Mobile Computing: Mobile Computing, is the use of portable computing devices (such 
as laptop and handheld computers) in conjunction with mobile communications 
technologies to enable users to access the Internet and data on their home or work 
computers from anywhere in the world. It is a human-computer interaction by which a 
computer is expected to be transported during normal usage. 

Mobile computing involves Mobile Communication, Mobile Hardware and Mobile 
Software; these are discussed as follows: 

• Mobile Communication: Mobile Communication refers to the infrastructure put in 
place to ensure that seamless and reliable communication goes on. These would 
include devices such as Protocols, Services, Bandwidth and Portals necessary to 
facilitate and support the stated services. The data format is also defined at this 
stage. The signals are carried over the air to intended devices that are capable of 
receiving and sending similar kinds of signals. It will incorporate all aspects of 
wireless communication. 
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• Mobile Hardware: Mobile Hardware includes mobile devices or device components 
that receive or access the service of mobility. They would range from Portable 
laptops, Smart phones, Tablet PC’s to Personal Digital Assistants. These devices 
will have receptors that are capable of sensing and receiving signals. These devices 
are configured to operate in full- duplex, whereby they are capable of sending and 
receiving signals at the same time. 

• Mobile Software: Mobile Software is the actual program that runs on the mobile 
hardware. It deals with the characteristics and requirements of mobile applications. 
This is the engine of that mobile device. In other terms, it is the operating system of 
that appliance. It is the essential component that makes the mobile device operates. 

Mobile computing is enabled by use of mobile devices (portable and hand held 
computing devices) such as PDA, laptops, mobile phones, MP3 players, digital cameras, 
tablet PC and Palmtops on a wireless network. 

The constant and ever increasing demand for superior and robust smart devices has 
been a catalyst for Smart phones that are capable of performing the same tasks as 
computers and at the same processing speed. Apple's iPhone OS, Google's Android, 
Microsoft Windows Mobile and Research in Motion's Blackberry OS, are constantly 
competing to offer better products with each release. 

A. Business Applications of Mobile Computing 

Mobile devices provide the capability to conduct business anywhere and enable users to 
seamless communicate and access information whether they are in the office or 
anywhere. Mobile computing is changing the business landscape. The change driven 
largely by video, web-browsing, gaming, and other entertainment related applications is 
one of the hottest trends in the consumer sector. Mobile computing is rapidly moving 
from gadget status to a must-have for consumers compelling more and more business 
services to be offered through this mode. As enterprises rush to encash the cost benefits 
of global business operations, mobile devices become increasingly indispensable. 

Mobile computing enables enterprises to connect with their employees at all times 
resulting in increased productivity and a better return on investments. Some examples of 
business applications are: 

• There is increase in workforce productivity as mobile device enables employees to 
work from anywhere, anytime by accessing and updating information as required. 
For example: employees can read/respond to emails using laptops, PDAs or smart 
phones from office, residence and even when on the move. 

• Customer service can be improved by responding to customer queries on site or off 
site. For example: customer complaints can be accessed and responded by 
accessing past/latest information of client as required. 
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• Incident management can be improved by resolving problems faster without 
limitation of time as the concerned employees can attend to these regardless of 
their location. Further, escalations can be updated in real time which ensures timely 
resolution of problems. For example: Computer breakdowns can be serviced by 
service engineers from their desks/outside by logging into the specific computer, 
identify problem and resolve it online. 

• Business processes can be transformed by using mobile devices. Enterprises can 
reengineer core business processes. The new and reengineered processes can 
focus on utilizing the key features of location and time independence. Enterprises 
can focus on providing customers and employees with access to information in 
different ways and provide the latest information. This enables employees, 
customers, and businesses to be available to one another as per their choice. For 
example: billing can be done by employees using hand held devices at customer 
site and the information updated online and deliveries to customers can be speeded 
up. 

• Enterprises can dynamically modify and update their offerings and offer new 
products and services altogether. For example: enterprises can implement 
telecommuting with flexible working hours and locations allowing for cost savings 
and better efficiency. 

• Mobile computing gives users the freedom to roam, with access to data and 
services at any time and in any place. Most of the high-end ERP and business 
software applications for SMEs have in-built capabilities of mobile computing 
enabling users to access data. Used with proper security, enterprises can harness 
the power of this technology to create innovative opportunities for improving the 
quality and efficiency of business processes and services. Mobile devices are 
increasingly acquiring the must-have status for enterprises on account of the 
increasing acceptance as business tools. 

B. Mobile Computing Concerns 

Major concerns relating to mobile computing are given as follows: 

• Mobile computing has its fair share of security concerns as any other technology. 

• Dangers of misrepresentation - Another problem plaguing mobile computing are 
credential verification. 

• Power consumption: When a power outlet or portable generator is not available, 
mobile computers must rely entirely on battery power. 

• Potential health hazards. 

Being an ever growing and emerging technology, mobile computing will continue to be a 

core service in computing, Information Communication and Technology. 
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2.7 Information System Layers 

Imagine that a Regional Sales Manager of an automobile manufacturing company wants to 
access sales figure relating to his/her region for the current quarter from the computerized 
information systems of the company. Let us try to visualize the processes involved: 

♦ Regional Sales Manager makes a request for sales information in ERP system 

(Application Program). 

♦ Using a keyboard attached to his/her desktop (Hardware). 

♦ Keyboard accepts his request in English and Windows 7 (Operating System - System 
Software) converts that request to Bits or the ASCII, which the system understands 
based on which computing gets done. 

♦ This request in form of Bits get converted to voltages travel on the cables, internet 
devices etc. to server at head office (Networks). 

♦ The server at head office will send the request to the ERP application end at the HO, 
which will then query the data through database such as Oracle (Database Management 
Systems-DBMS). 

♦ Get the data required and again through interactions among Operating System, 
Application Systems, networks, hardware and information will reach Regional Sales 
Manager (User - People). 

The above is of course a simplified version of process involved but gives a fair idea that any 
information system will have interaction amongst Application Software, DBMS, System 
Software, Hardware, Network links and People. These could be considered to be layers in 
Information system. These are pictoriaily represented in Fig. 2.7.1, which is given as follows: 




■ APPLICATIONS 






SYSTEM 

SOFTWARE 






NETWORK 

LINKS 


) 


Fig. 2.7.1: Layers in Information Systems 

Managers need to determine what types of hardware and software will satisfy their current and 
future business needs, the right time to buy the equipment, and how to protect their IT 
investments. This does not imply that managers need to be experts in all areas of technology; 
however, building a basic understanding of hardware and software can help them make the 
right IT investment choices. In the next section, we will take a look at the layers of IS in detail. 
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2.7.1 Application Software 

Application software includes all those computer software that cause a computer to perform 

useful tasks beyond the running of the computer itself. It is a collection of programs which 

address a real life problem of its end users which may be business or scientific or any other 

problem. 

The different types of application software are: 

♦ Application Suite: Has multiple applications bundled together. Related functions, 
features and user interfaces interact with each other. E.g. MS Office 2010 which has MS 
Word, MS Excel, MS Access, etc. 

♦ Enterprise Software: Addresses an enterprise's needs and data flow in a huge 
distributed environment. E.g. ERP Applications like SAP. 

♦ Enterprise Infrastructure Software: Provides capabilities required to support enterprise 
software systems. E.g. email servers, Security software. 

♦ Information Worker Software: Addresses individual needs required to manage and 
create information for individual projects within departments. E.g. Spreadsheets, CAAT 
(Computer Assisted Audit Toolsjetc. 

♦ Content Access Software: Used to access contents and addresses a desire for 
published digital content and entertainment. E.g. Media Players, Adobe Digital etc. 

♦ Educational Software: Holds contents adopted for use by students. E.g. Examination 
Test CDs 

♦ Media Development Software: Addresses individual needs to generate and print 
electronic media for others to consume. E.g. Desktop Publishing, Video Editing etc. 

Some of the most popular and widely accepted benefits of Application Software are: 

♦ Addressing User needs: Their single biggest advantage is that it meets the exact needs 
of the user. Since it is designed specifically with one purpose in mind, the user knows 
that he has to use the specific software to accomplish his task. 

♦ Less threat from virus: The threat of viruses invading custom-made applications is very 
small, since any business that incorporates it can restrict access and can come up with 
means to protect their network as well. 

♦ Regular updates: Licensed application software gets regular updates from the developer 
for security reasons. Additionally, the developer also regularly sends personnel to correct 
any problems that may arise from time to time. 

There are certain disadvantages of such software as well and these are given as follows: 

♦ Development is costly: Developing application software designed to meet specific 
purposes can prove to be quite costly for developers. 
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♦ Infection from Malware: If application software is used commonly by many people and 
shared online, it carries a highly real threat of infection by a computer virus or other 
malicious programs. 

2.7.2 Hardware 

Hardware is the tangible portion of our computer systems; something we can touch and see. It 
basically consists of devices that perform the functions of input, processing, data storage and 
output activities of the computer. Typical hardware architecture is shown in Fig. 2.7.2. 

(i) Input devices are devices through which we interact with the systems and include 
devices like Keyboard, Mouse and other pointing devices, Scanners & Bar Code, MICR 
readers, Webcams, Microphone and Stylus/ Touch Screen. Keyboard helps us with text 
based input, Mouse helps us in position based input, Scanners & Webcams help in 
image based input and Microphone helps us in voice based input. 

(ii) Processing devices include computer chips that contain the Central Processing Unit 
and main memory. The Central Processing Unit (CPU or microprocessor) is the actual 
hardware that interprets and executes the program (software) instructions and 
coordinates how ail the other hardware devices work together. The CPU is built on a 
small flake of silicon and can contain the equivalent of several million transistors. We can 
think of transistors as switches which could be” on” or “off” i.e., taking a value of 1 or 0. 
The processor or CPU is like the brain of the computer. The main function of CPU is to 
execute programs stored in memory. It consists of three functional units: 

• Control Unit (CU): CU controls the flow of data and instruction to and from 
memory, interprets the instruction and controls which tasks to execute and when. 

• Arithmetic and Logical Unit (ALU): Performs arithmetic operations such as 
addition, subtraction, multiplication, and logical comparison of numbers: Equal to, 
Greater than, Less than, etc. 

• Registers: These are high speed memory units within CPU for storing small amount 
of data (mostly 32 or 64 bits). Registers could be: 

> Accumulators: They can keep running totals of arithmetic values. 

> Address Registers: They can store memory addresses which tell the CPU as 
to where in the memory an instruction is located. 

> Storage Registers: They can temporarily store data that is being sent to or 
coming from the system memory. 

> Miscellaneous: These are used for several functions for general purpose. 

(iii) Data Storage Devices refers to the memory where data and programs are stored. 
Various types of memory techniques/devices are given as follows: 

(a) Internal memory: This includes Processer Registers and Cache Memory. 
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> Processor Registers: Registers are internal memory within CPU, which are 
very fast and very small. 

> Cache Memory: There is a huge speed difference between Registers and 
Primary Memory (discussed in lower section). In order to bridge these speed 
differences, we have cache memory. Cache (pronounced as cash) is a smaller, 
faster memory, which stores copies of the data from the most frequently used 
main memory locations so that Processor/Registers can access it more rapidly 
than main memory. It is the property of locality of reference, which allows 
improving substantially the effective memory access time in a computer 
system. 

(b) Primary Memory/Main Memory: These are devices in which any location can be 
accessed by the computer’s processor in any order (in contrast with sequential 
order). These are primarily of two types: 

> Random Access Memory (RAM) 

S Volatile in nature means Information is lost as soon as power is turned 
off. 

S This is Read Write memory. 

S Information can be read as well as modified. 

> Read Only Memory (ROM) 

S This is non volatile in nature (contents remain even in absence of power). 

S Usually, these are used to store small amount of information for quick 
reference by CPU. 

S Information can be read not modified. 

S Generally used by manufacturers to store data & programs like 
translators that is used repeatedly. 

(c) Secondary Memory: CPU refers to the main memory for execution of programs, 
but these main memories are volatile in nature and hence cannot be used to store 
data on a permanent basis in addition to being small in storage capacity. The 
secondary memories are available in bigger sizes, thus programs and data can be 
stored on secondary memories. Secondary storage differs from primary storage in 
that it is not directly accessible by the CPU. The computer usually uses its 
input/output channels to access secondary storage and transfers the desired data 
using intermediate area in primary storage. Secondary storage does not lose the 
data when the device is powered down: it is non-volatile. The features of secondary 
memory devices are non-volatility (contents are permanent in nature), greater 
capacity (they are available in large size), greater economy (the cost of these is 
lesser compared to register and RAMs) and slow speed (slower in speed compared 
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to registers or primary storage). Storage devices could differ amongst each other in 
terms of speed and access time, cost / portability, capacity and type of access. 
Based on these parameters most common forms of secondary storage are: USB 
Pen Drives, Floppy drive, Hard Drive, CD, DVD, Blue ray Disks and Smart cards. 



)utput Devices 


t 


Secondary Memory 


Fig. 2.7.2: Hardware Architecture 

(d) Virtual Memory: Virtual Memory is in fact not a separate device but an imaginary 
memory area supported by some operating systems (for example, Windows) in 
conjunction with the hardware. If a computer lacks the Random Access Memory 
(RAM) needed to run a program or operation, Windows uses virtual memory to 
compensate. Virtual memory combines computer’s RAM with temporary space on 
the hard disk. When RAM runs low, virtual memory moves data from RAM to a 
space called a paging file. Moving data to and from the paging file frees up RAM to 
complete its work. Thus, Virtual memory is an allocation of hard disk space to help 
RAM. 
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Fig. 2.7.3: Memory Techniques/Devices 
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A pictorial representation of all these aforementioned memory techniques/devices is 
given in Fig. 2.7.3: 

(iv) Output Devices: Computers systems provide output to decision makers at all levels in an 
enterprise to solve business problems, the desired output may be in visual, audio or digital 
forms. Output devices are devices through which system responds. Visual output devices 
like, a display device visually conveys text, graphics, and video information. Information 
shown on a display device is called soft copy because the information exists electronically 
and is displayed for a temporary period of time. Various types of Output Devices are: 

• Cathode-Ray Tube (CRT): A vacuum tube that uses an electron gun (cathode) to 
emit a beam of electrons that illuminates phosphors on a screen as the beam 
sweeps across the screen repeatedly. A monitor is often called a CRT. 

• Liquid Crystal Display (LCDs): A low-powered display technology used in laptop 
computers where rod-shaped crystal molecules change their orientation when an 
electrical current flows through them. 

• Laser Printer: A printer that forms images using an electrostatic process, the same 
way a photocopier works. 

• Ink-jet Printer: A printer that makes images by forcing ink droplets through nozzles. 

• Plotter: A printer that uses computer-directed pens for creating high-quality images, 
blueprints, schematics, etc. 

• Speakers: Gives an audio output. 

2.7.3 System Software 

System software is computer software that is designed to operate the computer hardware and 
to give and maintain a platform for running application software. One of the most important 
and widely used system software is computer operating systems. 

An Operating System (OS) is a set of computer programs that manages computer hardware 
resources and acts as an interface with computer applications programs. The operating 
system is a vital component of the system software in a computer system. Application 
programs usually require an operating system to function that provides a convenient 
environment to users for executing their programs. Computer hardware with operating system 
can thus be viewed as an extended machine, which is more powerful and easy to use. Some 
prominent Operating systems used nowadays are Windows 7, Windows 8, Linux, UNIX, etc. 

A variety of activities are executed by Operating systems which include: 

♦ Performing hardware functions: Application programs to perform tasks have to obtain 
input from keyboards, retrieve data from disk & display output on monitors. Achieving all 
this is facilitated by operating system. Operating system acts as an intermediary between 
the application program and the hardware. 


© The Institute of Chartered Accountants of India 




Information Systems and IT Fundamentals 2.33 


♦ User Interfaces; An important function of any operating system is to provide user 
interface. If we remember DOS days, it had a command based User Interface (Ul) i.e. 
text commands were given to computer to execute any command. But today we are more 
used to Graphic User Interface (GUI) which uses icons & menus like in the case of 
Windows. So, how we interface with our system will be provided by Operating system. 

♦ Hardware Independence: Every computer could have different specifications and 
configurations of hardware. If application developer would have to rewrite code for every 
configuration s/he would be in a big trouble. Fortunately, we have operating system, 
which provides Application Program Interfaces (API), which can be used by application 
developers to create application software, thus obviating the need to understand the 
inner workings of OS and hardware. Thus, OS gives us hardware independence. 

♦ Memory Management: Memory Management features of Operating System allow 
controlling how memory is accessed and maximize available memory & storage. 
Operating systems also provides Virtual Memory by carving an area of hard disk to 
supplement the functional memory capacity of RAM. In this way it augments memory by 
creating a virtual RAM. 

♦ Task Management: Task Management feature of Operating system helps in allocating 
resources to make optimum utilization of resources. This facilitates a user to work with 
more than one application at a time i.e. multitasking and also allows more than one user 
to use the system i.e. timesharing. 

♦ Networking Capability: Operating systems can provide systems with features & 
capabilities to help connect computer networks. Like Linux & Windows 8 give us an 
excellent capability to connect to internet. 

♦ Logical access security: Operating systems provide logical security by establishing a 
procedure for identification & authentication using a User ID and Password. It can log the 
user access thereby providing security control. 

♦ File management: The operating system keeps a track of where each file is stored and 
who can access it, based on which it provides the file retrieval. 

2.7.4 Network Links 

In today’s high speed world, we cannot imagine an information system without an effective 
communication system. Effective and efficient communication is a valuable resource which 
helps in good management. To enable this communication, we need communication networks. 

Computer Network is a collection of computers and other hardware interconnected by 
communication channels that allow sharing of resources and information. Where at least one 
process in one device is able to send/receive data to/from at least one process residing in a 
remote device, then the two devices are said to be in a network. A network is a group of 
devices connected to each other. 
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Each component, namely the computer in a computer network is called a ‘Node’. Computer 
networks are used for exchange of data among different computers and also to share the 
resources. Field of computer networks is one of the most interesting and rapidly growing fields 
in computer science. With man’s desire for faster and better processing power, existing 
computer systems are connected to each other to form a computer network which allows them 
to share CPU, I/O devices, storages, etc. without much of an impact on individual systems. 

In real world, we see numerous networks like Telephone/ mobile network, postal networks etc. 
If we look at these systems, we can analyze that networks could be of two types: 

♦ Connection Oriented networks: Wherein a connection is first established and then data 
is exchanged like it happens in case of telephone networks. 

♦ Connectionless Networks: Where no prior connection is made before data exchanges. 
Data which is being exchanged in fact has a complete contact information of recipient 
and at each intermediate destination, it is decided how to proceed further like it happens 
in case of postal networks. 

These real world networks have helped model computer networks. Each of these networks is 
modeled to address the following basic issues: 

♦ Routing: It refers to the process of deciding on how to communicate the data from 
source to destination in a network. 

♦ Bandwidth: It refers to the amount of data which can be sent across a network in given 
time. 

♦ Resilience: It refers to the ability of a network to recover from any kind of error like 
connection failure, loss of data etc. 

♦ Contention: It refers to the situation that arises when there is a conflict for some 
common resource in a network. For example, network contention could arise when two 
or more computer systems try to communicate at the same time. 

The following are the important benefits of a computer network: 

♦ Distributed nature of information: There would be many situations where information 
has to be distributed geographically. E.g. in the case of Banking Company, accounting 
information of various customers could be distributed across various branches but to 
make Consolidated Balance Sheet at the year-end, it would need networking to access 
information from all its branches. 

♦ Resource Sharing: Data could be stored at a central location and can be shared across 
different systems. Even resource sharing could be in terms of sharing peripherals like 
printers, which are normally shared by many systems. E.g. In the case of a CBS, Bank 
data is stored at a Central Data Centre and could be accessed by all branches as well 
as ATMs. 

♦ Computational Power: The computational power of most of the applications would 
increase drastically if the processing is distributed amongst computer systems. For 
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example: processing in an ATM machine in a bank is distributed between ATM machine 
and the central Computer System in a Bank, thus reducing load on both. 

♦ Reliability: Many critical applications should be available 24x7, if such applications are 
run across different systems which are distributed across network then the reliability of 
the application would be high. E.g. In a city there could be multiple ATM machines so 
that if one ATM fails, one could withdraw money from another ATM. 

♦ User communication: Networks allow users to communicate using e-mail, newsgroups, 
video conferencing, etc. 

2.7.5 Database Management Systems (DBMS) 

Every enterprise needs to manage its information in an appropriate and desired manner. The 
enterprise has to do the following for this: 

♦ Knowing its information needs; 

♦ Acquiring that information; 

♦ Organizing that information in a meaningful way; 

♦ Assuring information quality; and 

♦ Providing software tools so that users in the enterprise can access information they 
require. 

To achieve the above objectives, we use Data Base Management System. Let’s think of a 
DBMS as basically just a computerized record keeping. Database is just an electronic filing 
cabinet i.e., a collection of computerized data files. Even this simple system helps us do 
various operations on the files, such as: 

♦ Adding new files to database, 

♦ Deleting existing files from database, 

♦ Inserting data in existing files, 

♦ Modifying data in existing files, 

♦ Deleting data in existing files, and 

♦ Retrieving or querying data from existing files. 

DBMS are software that aid in organizing, controlling and using the data needed by the 
application programme. They provide the facility to create and maintain a well-organized 
database. Applications access the DBMS, which then accesses the data. Commercially 
available Data Base Management Systems are Oracle, My SQL, SQL Servers and DB2 etc. 
Some other related aspects of DBMS are given as follows: 

(i) Data, Databases, Data Models: The word Data is derived from Latin meaning “to give’’, 
thus Data is given facts from which additional facts can be inferred. Thus database is a 
collection of facts. Let’s now look at the database model hierarchy. Hierarchy of database is 
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as under: 

♦ Database: This is a collection of Files. 

♦ File: This is a collection of Records. 

♦ Record: This is a collection of Fields. 

♦ Field: This is a collection of Characters. 

♦ Characters: These are a collection of Bits. 
This hierarchy is shown in the Fig. 2.7.4: 
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Fig. 2.7.4: Hierarchy of Databases 

A database model is a type of data model that determines the logical structure of a database 
and fundamentally determines in which manner data can be stored, organized and 
manipulated. Some prominent database models are: 

(i) Hierarchical Database Model, 

(ii) Network Database Model, 

(iii) Relational Database Model, and 

(iv) Object Oriented Database Model 

A. Hierarchical Database Model: In a hierarchical database model, records are logically 
organized into a hierarchy of relationships. A hierarchically structured database is arranged 
logically in an inverted tree pattern. For example, an equipment database, diagrammed in Fig. 
2.7.5 may have building records, room records, equipment records, and repair records. The 
database structure reflects the fact that repairs are made to equipment located in rooms that 
are part of buildings. 

All records in hierarchy are called nodes. Each node is related to the others in a parent-child 
relationship. Each parent record may have one or more child records, but no child record may 
have more than one parent record. Thus, the hierarchical data structure implements one-to- 
one and one-to-many relationships. 

The top parent record in the hierarchy is called the root record. In this example, building 
records are the root to any sequence of room, equipment, and repair records. Entrance to this 
hierarchy by the database management system is made through the root record i.e., building. 
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Records that “own” other records are called parent records. For example, room records are 
the parents of equipment records. Room records are also children of the parent record, 
building. There can be many levels of node records in a database. 



Root 

Parent of room 


Children of root 
Parents of equipment 


Children of room 
Parents of repair 


Children of 
equipment 


Fig. 2.7.5: Hierarchical Database Model 

B. Network Database Model: The network model is a variation on the hierarchical model, 
to the extent that it is built on the concept of multiple branches (lower-level structures) 
emanating from one or more nodes (higher-level structures), while the model differs from the 
hierarchical model in that branches can be connected to multiple nodes. The network model is 
able to represent redundancy in data more efficiently than in the hierarchical model. 

A network database structure views all records in sets. Each set is composed of an owner 
record and one or more member records. This is analogous to the hierarchy’s parent-children 
relationship. Thus, the network model implements the one-to-one and the one-to-many record 
structures. 

However, unlike the hierarchical mode, the network model also permits a record to be a 
member of more than one set at one time. The network model would permit the equipment 
records to be the children of both the room records and the vendor records. This feature 
allows the network model to implement the many-to-one and the many-to-many relationship 
types. 

Network databases generally implement the set relationships by means of pointers that 
directly address the location of a record on disk. This gives excellent retrieval performance, at 
the expense of operations such as database loading and reorganization. 

For example, suppose that in our database, it is decided to have the following records: repair 
vendor records for the companies that repair the equipment, equipment records for the various 
machines we have, and repair invoice records for the repair bills for the equipment. Suppose 
four repair vendors have completed repairs on equipment items 1,2, 3, 4, 5, 6, 7 and 8. These 
records might be logically organized into the sets shown in Fig. 2.7.6. 


© The Institute of Chartered Accountants of India 


2.38 Information Technology 


Notice these relationships: 

(i) Repair Vendor 1 record is the owner of the Repair Invoice 1 record. This is a one-to-one 
relationship. 

(ii) Repair Vendor 2 record is the owner of the Repair Invoice 2 and 3 records. This is a one- 
to-many relationship. 

(iii) Repair Vendor 3 record is the owner of Repair Invoice 4 and 5 records, and the 
Equipment 7 record owns both the Repair Invoice 5 and 6 records because it was fixed 
twice by different vendors. Because many equipment records can own many Repair 
Invoice records, these database records represent a many-to-many relationship. 

(iv) Equipment 6 record does not own any records at this time because it is not required to be 
fixed yet. 


(v) Equipment 7 and 8 own Repair Invoice 6 because the repairs to both machines were 
listed on the same invoice by Repair Vendor 4. This illustrates the many-to-one 
relationship. 



Fig. 2.7.6: Example of Network Database Model 

Thus, all the repair records are members of more than one owner-member set: the repair 
vendor-repair invoice set and the equipment-repair invoice set. The network model allows us 
to represent one-to-one, one-to-many and many-to-many relationships. The network model 
also allows us to create owner records without member records. Thus, we can create and 
store a record about a new piece of equipment even though no repairs have been made on 
the equipment yet. 

Unlike hierarchical data structures that require specific entrance points to find records in a 
hierarchy, network data structures can be entered and traversed more flexibly. 

C. Relational Database Model: A third database structure is the relational database mode. 
Both the hierarchical and network data structures require explicit relationships, or links, 
between records in the database. Both structures also require that data be processed one 
record at a time. The relational database structure departs from both these requirements. 
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A relational database allows the definition of data and their structures, storage and retrieval 
operations and integrity constraints that can be organized in a table structure. A table is a 
collection of records and each record in a table contains the same fields. 

Three key terms are used extensively in relational database models: relations, attributes, 
and domains. A relation is a table with columns and rows. The named columns of the relation 
are called attributes, and the domain is the set of values the attributes are allowed to take. 

All relations (and, thus, tables) in a relational database have to adhere to some basic rules to 
qualify as relations. First, the ordering of columns is immaterial in a table. Second, there can't 
be identical record in a table. And third, each record will contain a single value for each of its 
attributes. 

A relational database contains multiple tables, with at least similar value occurring in two 
different records (belonging to the same table or to different tables) that implies a relationship 
among those two records. The relationships between records in tables can also be defined 
explicitly, by identifying or non-identifying parent-child relationships characterized by assigning 
cardinality (1:1, 1:M, M:M). Tables can also have a designated single attribute or a set of 
attributes that can act as a "key", which can be used to uniquely identify each record in the 
table. 

A key that can be used to uniquely identify a row in a table is called a primary key. Keys are 
commonly used to join or combine data from two or more tables. For example, an Employee 
table may contain a column named Location which contains a value that matches the key of a 
Location table. Keys are also critical in the creation of indexes, which facilitate fast retrieval of 
data from large tables. Any column can be a key, or multiple columns can be grouped together 
into a compound key. 

D. Object Oriented Data Base Model: It is based on the concept that the world can be 
modeled in terms of objects and their interactions. Objects are entities conveying some 
meaning for us and possess certain attributes to characterize them and interacting with each 
other. An Object-oriented database provides a mechanism to store complex data such as 
images, audio and video, etc. An object oriented database (also referred to as object-oriented 
database management system or OODBMS) is a set of objects. In these databases, the data 
is modeled and created as objects. 

An Object-Oriented Database Management System (OODBMS) helps programmers make 
objects created in a programming language behave as a database object. Object-oriented 
programming is based on a series of working objects. Each object is an independently 
functioning application or program, assigned with a specific task or role to perform. An object- 
oriented database management system is a relational database designed to manage all of 
these independent programs, using the data produced to quickly respond to requests for 
information by a larger application. 

In the Fig. 2.7.7, the light rectangle indicates that ‘engineer’ is an object possessing attributes 
like ‘date of birth’, ‘address’, etc. which is interacting with another object known as ‘civil jobs’. 
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When a civil job is commenced, it updates the ‘current job’ attribute of the object known as 
‘engineer’, because ‘civil job’ sends a message to the latter object. 

Objects can be organized by first identifying them as a member of a class / subclass. Different 
objects of a particular class should possess at least one common attribute. The dark 
rectangles indicate ‘Engineer’ as a class and ‘Civil Engineer’ and also ‘Architect’ as both 
subclasses of ‘Engineer’. These subclasses possess all the attributes of ‘Engineer’ over and 
above each possessing at least one attribute not possessed by ‘Engineer’. The line 
intersecting particular object classes represents the class of structure. 



Fig. 2.7.7: An object-oriented database design 

Secondly, objects can be identified as a component of some other object. ‘Engineers’ are 
components of a ‘Civil Job Team’ which may have one to more than one number of 
member(s). An ‘Engineer’ may not be a member of the ‘Civil Job Team’ and may not be a 
member of more than one team. The dotted line intersecting particular object classes 
represents the part of structure. Apart from possessing attributes, objects as well as possess 
methods or services that are responsible for changing their states. 
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In the Fig. 2.7.7 for example, the service ‘Experience’ as a Civil Engineer or Architect for the 

object ‘Engineer’ calculates how much experience the engineers of these particular two 

subclasses have as professionals. 

(ii) Advantages of a DBMS 

Major advantages of DBMS are given as follows: 

♦ Permitting data sharing: One of the principle advantages of a DBMS is that the same 
information can be made available to different users. 

♦ Minimizing Data Redundancy: In a DBMS duplication of information or redundancy is, if 
not eliminated, carefully controlled or reduced i.e. there is no need to repeat the same 
data over and over again. Minimizing redundancy can therefore significantly reduce the 
cost of storing information on hard drives and other storage devices. 

♦ Integrity can be maintained: Data integrity is maintained by having accurate, 
consistent, and up-to-date data. Updates and changes to the data only have to be made 
in one place in DBMS ensuring Integrity. The chances of making a mistake increase if the 
same data needs to be changed at several different places than making the change in 
one place. 

♦ Program and file consistency: Using a DBMS, file formats and programs are 
standardized. This makes the data files easier to maintain because the same rules and 
guidelines apply across all types of data. The level of consistency across files and 
programs also makes it easier to manage data when multiple programmers are involved. 

♦ User-friendly: DBMS makes the data access and manipulation easier for the user. 
DBMS also reduce the reliance of users on computer experts to meet their data needs. 

♦ Improved security: DBMSs allow multiple users to access the same data resources 
which could lead to risk to an enterprise if not controlled. Security constraints can be 
defined i.e. Rules can be built to give access to sensitive data. Some sources of 
information should be protected or secured and only viewed by select individuals. 
Through the use of passwords, database management systems can be used to restrict 
data access to only those who should see it. 

♦ Achieving program/data independence: In a DBMS data does not reside in 
applications but data bases program & data are independent of each other. 

♦ Faster application development: In the case of deployment of DBMS, application 
development becomes fast. The data is already therein databases, application developer 
has to think of only the logic required to retrieve the data in the way a user needs. 

(iii) Disadvantages of a DBMS 

There are basically two major downsides to using DBMSs. One of these is cost (both system 

and user training), and the other is the threat to data security. These are given as under: 
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♦ Cost: Implementing a DBMS system can be expensive and time-consuming, especially in 
large enterprises. Training requirements alone can be quite costly. 

♦ Security: Even with safeguards in place, it may be possible for some unauthorized users 
to access the database. If one gets access to database then it could be an all or nothing 
proposition. 

2.7.6 People/Users 

People are the most important element in most computer-based information systems. The 
people involved include users of the system and information systems personnel, including all 
the people who manage, run, program, and maintain the system. 

In the ever-changing world, innovation is the only key, which can sustain long-run growth. 
More and more firms are realizing the importance of innovation to gain competitive advantage. 
Accordingly, they are engaging themselves in various innovative activities. Understanding 
these layers of information system helps any enterprise grapple with the problems it is facing 
and innovate to perhaps reduce total cost of production, increase income avenues and 
increase efficiency of systems. 


Case Study 


Atul, a part of Lalbhai group, is a producer of agrochemicals, pharmaceuticals, aromatics, 
polymers, etc. Atul’s accounts payable were largely built on a manual system. Whenever a 
shipment of goods arrived at Atul’s factories, it was received by a store clerk who checked it 
for quality and quantity. The clerk then entered its details into Atul’s computer system and 
generated a Goods Receipt Note (GRN). The invoices for the material accompanied with their 
GRNs were hand delivered to the accounts payable desk, whose staff then entered details into 
their system and created an accounts payable invoice. This new invoice was then sent to the 
company’s CENVAT (Central Value Added Tax) reversal cell, whose job was to reclaim 
CENVAT. But many manual processes created a delay of up to 15 days between the time a 
store clerk received goods and the CENVAT team could reclaim CENVAT. 

To tackle this problem, Atul integrated the accounts payable module of ERP with an 
automated invoice scanning system. The solution cleansed the accounts payable process of 
manual delays and mistakes in entry - ensuring that invoices are sent to the accounts payable 
team instantly and that Accounts Payable invoices are sent to the CENVAT team swiftly. The 
solution added ? 3 crores worth of CENVAT credits in Atul’s books. First, the number of 
misplaced invoices or related documents shrunk to 0 from about 50 per month. The increased 
visibility ensured that payments to suppliers are made faster, shrinking late payment charges 
and increasing early payment bonuses. It also allowed for the faster identification of payable 
liabilities. 
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2.8 Information System Life Cycle 

This is commonly referred as Software/System Development Life Cycle (SDLC), which is a 
methodology used to describe the process of building information systems. It is the logical 
starting point in the entire life cycle of a computerized system. Activities start when any 
enterprise decides to go for computerization or migrate from existing computerized system to 
a new one. 


SDLC framework provides a sequence of activities for system designers and developers to 
follow. It consists of a set of steps or phases in which each phase of the SDLC uses the 
results of the previous one. This serves as a guideline to the designer, who seeks to use it as 
template while working on a project development. 

An SDLC adheres to important phases that are essential for developers, such as Investigation, 
Analysis, design, implementation and maintenance and review; these are pictorially shown in 
Fig. 2.8.1. This includes evaluation of present system, information gathering; feasibility study 
and request approval. 


In an organization, the current system may no longer be suitable for its purpose. 
Technological developments may have made the current system redundant or out-dated or the 
current system may be too inflexible or expensive to maintain. That is why the need for 
developing for new information system is generated. Various phases for developing an 
information system are given as follows: 


/ 


INVESTIGATE 
Understand the Problem 


\ 


MAINTEf 

Eval 

L 

ANCE & REVIEW 
uate Results 

J 


ANALYSE 

Assess the Solutions 

L J 



~ A 

DESIGN 


IMPLEMENT 

Design or select the 

F 

*ut Solution into affect 






Fig. 2.8.1: SDLC Phases 
2.8.1 Phase 1: System Investigation 

This phase examines that ‘What is the problem and is it worth solving’? We would be doing a 
feasibility study under the following dimensions: 

♦ Technical feasibility: Does the technology exist to implement the proposed system or is 
it a practical proposition? 
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♦ Economic feasibility: Is proposed system cost-effective: if benefits do not outweigh 
costs, it’s not worth going ahead? 

♦ Legal feasibility: Is there any conflict between the proposed system and legal 
requirements? 

♦ Operational feasibility: Are the current work practices and procedures adequate to 
support the new system? 

♦ Schedule feasibility: How long will the system take to develop, or can it be done in a 
desired time-frame? 

2.8.2 Phase 2: System Analysis 

This phase examines that ‘What must the Information System do to solve the problem’? 

System analyst would be gathering details about the current system and will involve: 

♦ Interviewing staff: at different levels from end-users to senior management; 

♦ Examine current business: systems documents and output including current order 
documents, computer system procedures and reports used by operations and senior 
management; 

♦ Sending out questionnaires: that have to be carefully constructed to elicit unambiguous 
answers; and 

♦ Observation of current procedures: by spending time in various departments. A time 
and motion study can show where procedures could be more efficient or to detect 
bottlenecks. 

The Systems Analyst will: 

♦ Examine data and information flows in the enterprise using data flow diagrams; 

♦ Establish what the proposed system will actually do (not how it will do it); 

♦ Analyze costs and benefits; 

♦ Outline system implementation options, (e.g. in-house or using consultants); 

♦ Consider possible hardware configurations; and 

♦ Make recommendations. 

2.8.3 Phase 3: System Designing 

This phase examines that ‘How will the Information System do that it must do to obtain the 

solution to the problem’? This phase specifies the technical aspects of a proposed system in 

terms of: 

♦ Hardware platform: Computer, network capabilities, input, storage and output devices; 

♦ Software: Programming language, package and database; 

♦ Outputs: Report layouts and screen designs; 

♦ Inputs: Documents, screen layouts and validation procedures; 
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♦ User interface: How users will interact with the computer system; 

♦ Modular design: Of each program in the application; 

♦ Test plan: Develop test data; 

♦ Conversion plan: How the new system is to be implemented; and 

♦ Documentation: Including systems and operations documentation. Later, a user manual 
will be produced. 

2.8.4 Phase 4: System Implementation 

This phase examines that ‘How will the Solution be put into effect’? This phase involves the 
following steps: 

♦ Coding and testing of the system; 

♦ Acquisition of hardware and software; and 

♦ Either installation of the new system or conversion of the old system to the new one. 

In Installation, there are following major activities: 

♦ Installing the new hardware, which may involve extensive re-cabling and changes in 
office layouts; 

♦ Training the users on the new system; and 

♦ Conversion of master files to the new system or creation of new master files. 

In Conversion, there are following major activities: 

♦ Direct Changeover: The user stops using the old system one particular day and starts 
using the new system from thereon, usually over a weekend or during a slack period. 

♦ Parallel Conversion: The old system continues alongside the new system for a few 
weeks or months. 

♦ Phased Conversion: Used with larger systems that can be broken down into individual 
modules which can be implemented separately at different times. 

♦ Pilot Conversion: New system will first be used by only a portion of the enterprise, for 
example at one branch or factory. 

2.8.5 Phase 5: System Maintenance and Review 

This phase evaluates results of solution and modifies the system to meet the changing needs. 
Post implementation review would be done to address: 

♦ Programming amendments, 

♦ Adjustment of clerical procedures, 

♦ Modification of Reports, and 

♦ Request for new programs. 
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System maintenance could be with following different objectives: 

♦ Perfective Maintenance: This implies that while the system runs satisfactorily, there is 
still room for improvement. 

♦ Adaptive Maintenance: All systems will need to adapt to changing needs within a 
company. 

♦ Corrective Maintenance: Problems frequently surface after a system has been in use 
for a short time, however thoroughly it was tested. Any errors must be corrected. 

This is often the longest of the stages since it is an on-going process having some sort of long 
term continuum. 

2.9 Recent Technologies/Devices 

As we said earlier that technology is evolving in nature and accordingly, various new 
technologies, which effect enterprises, are given in the following sections. 

2.9.1 Bluetooth 

Bluetooth is a wireless technology standard for exchanging data over short distances up to 
50 meters (164 feet) from fixed and mobile devices, creating Personal Area Networks (PANs) 
with high levels of security. It is a feature which is used every day through a number of 
compatible devices. 

Bluetooth is really like a very low-power, short-range radio signal. Bluetooth signals are secure 
from the moment they're sent, so unlike any other wireless network we don't have to worry 
about turning on security. Few devices that utilize Bluetooth technology are as follows: 

♦ Keyboards and mice, 

♦ Printers, 

♦ Cell phones and headsets, 

♦ PDAs (Personal Digital Assistants), 

♦ Desktop and laptop computers, 

♦ Digital cameras, and 

♦ Remotes: replacing IR (infrared). 

Through the use of a mobile phone with Bluetooth enabled in them, we can send pictures, 
videos, exchange business cards and also transfer files to our PC. Both data and voice 
transmissions can be sent and received through the use of short range networks. 

2.9.2 Wi-Fi 

Wi-Fi is the name of a popular wireless networking technology that uses radio waves to 
provide wireless high-speed Internet and network connections. Wi-Fi networks have limited 
range. A typical wireless access point might have a range of 32 meters (120 ft.). 
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The Wi-Fi Alliance, the organization that owns the Wi-Fi (registered trademark) term 
specifically defines Wi-Fi as any "wireless local area network (WLAN) products that are based 
on the Institute of Electrical and Electronics Engineers' (IEEE) 802.11 standards. Wi-Fi can be 
less secure than wired connections because an intruder does not need a physical connection. 
Wi-Fi networks use radio technologies called 802.11 to provide secure, reliable, fast wireless 
connectivity. A Wi-Fi network can be used to connect electronic devices to each other, to the 
Internet, and to wired networks (which use Ethernet technology). 

Large corporations and campuses use enterprise-level technology and Wi-Fi products to 
extend standard wired Ethernet networks to public areas like meeting rooms, training 
classrooms and large auditoriums. Many corporations also provide wireless networks to their 
off-site and telecommuting workers to use at home or in remote offices. Large companies and 
campuses often use Wi-Fi to connect buildings. 

Wi-Fi networks also work well for small businesses, providing connectivity between mobile 
salespeople, floor staff and behind-the-scenes finance and accounting departments. Because 
small businesses are dynamic, the built-in flexibility of a Wi-Fi network makes it easy and 
affordable for them to change and grow. 

2.9.3 Laptop: Notebook 

Laptop is a small, portable computer and small enough that it can sit on a lap. The laptop was 
originally designed to be similar to a desktop, but be small and light enough that it could be 
used while sitting in our lap. Notebook is an extremely lightweight personal computer. 
Notebook computers typically weigh less than 3 Kg and are small enough to fit easily in a 
briefcase. Notebook computers use flat-panel technologies, to produce a lightweight and non- 
bulky display screen. If we consider computing power, modern notebook computers are almost 
equivalent to personal computers having the same CPUs, memory capacity and disk drives. 
These days due to reduction in size, weight the difference between Laptop and Notebook has 
become very thin and computer laptop is more frequently called a notebook computer. The 
difference between a laptop and notebook today is mainly what the manufacturer chooses to 
call its product. 

2.9.4 Tablet Computer or Tablet 

A Tablet Computer or simply tablet is a one piece general-purpose computer contained in a 
single panel. Its distinguishing characteristic is the use of a touch screen as the input device. 
Modern tablets are operated by fingers, and a stylus is an option, whereas earlier tablets 
required a stylus. Tablet PCs have become quite popular thanks to their extreme portability, 
easy to use interfaces and the wide range of ways they can be used. In many ways, they can 
almost replace a laptop for someone on the go. 

Some features of Tablets are: 

♦ Input Method: Tablets rely solely on a touch interface on the screen for all input. 
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♦ Size: This is probably the biggest reason to go with a tablet PC. Tablets have the size 
roughly of a small pad of paper and a weight that is less than one Kg. 

♦ Battery Life: Tablets are design for efficiency because of the low power requirements of 
their hardware components. Tablets can achieve all day usage. 

♦ Storage Capacity: Most tablets come with configurations that allow between 16 and 64 
gigabytes of storage. 

♦ Performance: Since most tablet PCs are based on extremely low powered processors 
more suited for tasks like email, web browsing, playing video or audio. 

♦ Software: The two major tablet platforms are Android and iOS amongst plenty of 
applications that are available. 

♦ Wireless: Because tablets by design are mobile computers; most of them have Wi-Fi, 
blue tooth and mobile connectivity. 

2.9.5 SmartPhone 

A SmartPhone is a mobile phone built on a mobile operating system, with more advanced 
computing capability connectivity than a feature phone. A smart phone could be considered to 
be the combination of the traditional PDA and cellular phone, with a bigger focus on the 
cellular phone part. These handheld devices integrate mobile phone capabilities with the more 
common features of a handheld computer or PDA. Smartphone’s allow users to store 
information, e-mail and install programs, along with using a mobile phone in one device. A 
smart phone's features are usually more oriented towards mobile phone options than the PDA- 
like features. Modern smart phones also include high-resolution touch screens and web 
browsers that display standard web pages as well as mobile-optimized sites. High-speed data 
access is provided by Wi-Fi and mobile broadband. 

2.9.6 Touchpad 

A Touchpad is a pointing device featuring a tactile sensor, a specialized surface that can 
translate the motion and position of a user's fingers to a relative position on screen. 
Touchpads are a common feature of laptop computers, and are also used as a substitute for a 
mouse where desk space is scarce. Because they vary in size, they can also be found on 
Personal Digital Assistants (PDAs) and some portable media players. Wireless touchpads are 
also available as detached accessories. 

Touchpads operate in one of several ways, including capacitive sensing and conductance 
sensing. The most common technology used entails sensing the capacitive virtual ground 
effect of a finger, or the capacitance between sensors. Capacitance-based touchpads will not 
sense the tip of a pencil or other similar implement. Gloved fingers may also be problematic. 

While touchpads, like touch screens, are able to sense absolute position, resolution is limited 
by their size. For common use as a pointer device, the dragging motion of a finger is 
translated into a finer, relative motion of the cursor on the screen, analogous to the handling of 
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a mouse that is lifted and put back on a surface. Hardware buttons equivalent to a standard 
mouse's left and right buttons are positioned below, above, or beside the touchpad. 

2.9.7 iPad 

The iPad runs a version of iOS. iOS is designed for finger based use and has none of the tiny 
features which required a stylus on earlier tablets. Apple introduced responsive multi touch 
gestures, like moving two fingers apart to zoom in. iOS uses less power, and so gives better 
battery life than the Intel devices used by Windows tablets. 

2.9.8 iPod 

The iPod is a line of portable media players designed and marketed by Apple Inc. The first 
line was released on October 23, 2001, about 8!4 months after iTunes (Macintosh version) 
was released. Its most recent redesigns were announced on September 12, 2012. There are 
four current versions of the iPod: the ultra-compact iPod Shuffle, the compact iPod Nano, the 
touch screen iPod Touch, and the hard drive-based iPod Classic. 

Like other digital music players, iPods can serve as external data storage devices. Storage 
capacity varies by model, ranging from 2 GB for the iPod Shuffle to 160 GB for the iPod 
Classic. 

2.9.9 Ultra-Mobile PC (UMPC) 

An Ultra-Mobile PC is a small form factor version of a pen computer, a class of laptop whose 
specifications were launched by Microsoft and Intel in spring 2006. UMPCs are smaller than 
subnotebooks, have a TFT display measuring (diagonally) about 12.7 to 17.8 cm (5 to 7 inch 
screen), are operated like tablet PCs using a touch screen or a stylus, and can also have a 
physical keyboard. There is no clear boundary between subnotebooks and ultra-mobile PCs. 

The first-generation UMPCs were simple PCs running Linux or an adapted version of 
Microsoft's tablet PC operating system. With the announcement of the UMPC, Microsoft 
dropped the licensing requirement that tablet PCs must support proximity sensing of the 
stylus, which Microsoft termed "hovering". 

2.9.10 Android 

Android is a Linux-based operating system designed primarily for touch screen mobile 
devices such as smart phones and tablet computers. Android was built to enable developers 
to create compelling mobile applications that take full advantage of all a handset has to offer. 
Android powers devices from some of the best handset and tablet manufacturers in the world, 
like Samsung, HTC, Motorola, Sony, Asus and more. Android devices come in all shapes and 
sizes, with vibrant high-resolution displays and cameras, giving the flexibility to choose the 
one that’s just right for a user. 

Android is an open source and the permissive licensing allows the software to be freely 
modified and distributed by device manufacturers, wireless carriers and enthusiast developers. 
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Android provides access to a wide range of useful libraries and tools that can be used to build 
rich applications. 

2.10 Summary 

In this chapter, we learnt about IT as a key enabler in modern enterprises and the relevance of 
IT on auditing in terms of risks, security, control and changes required in audit process and 
procedures. We learnt how any enterprise to be effective and efficient has to use Business 
Process Automation (BPA), which is largely aided by Computers or IT. Information systems, 
which forms the backbone of any enterprise comprises of various layers such as: Application 
software, Database Management Systems (DBMS), System Software: Operating Systems, 
Hardware, Network Links and People-Users. 

We have also understood that whenever an information system has to be deployed for the first 
time or some major changes are required, we need to implement information system life cycle. 
This has different phases, which encompass system development, system Investigation, 
system analysis, system design, system implementation and system Maintenance and review. 
This together are also referred to as the system development life cycle. We also learnt 
different terminologies relating to computing Technologies including popular computing 
technologies and emerging computing models such as Mobile Computing and some latest 
technologies like Bluetooth, Wi-Fi, Android, etc. 
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